@co0ontty/wand 4.96.1-beta.365.1.g4847c70 → 4.97.0

package/README.md

@@ -183,7 +183,11 @@ npm uninstall -g opencode
 npm install -g opencode-ai@latest
 ```
 
-```
+New system employees default to OpenCode's **Free group**, a saved Wand-managed group (`wand-model-group/opencode/opencode-free`), not an implicit fallback. Every six hours the server refreshes the native catalog and actually tests every native zero-priced `opencode/*` candidate (including models without a `-free` suffix), adds new usable models and removes retired, paid or failed models while preserving saved priority. Membership is server-owned; clients may reorder it. A one-time default migration prepends this group while retaining existing candidates; later manual edits are not overwritten on restart. If all four slots are already occupied, no candidate is discarded: the server asks for a free slot instead. If the CLI is missing, the server installs `opencode-ai` under the configuration directory's `tools/opencode/`, without sudo or changing global npm packages. Free system text calls use a separate anonymous profile under `tools/opencode-system/` (no user credentials, project configuration or authorized tools), and check native pricing before execution. An empty/unavailable group never selects a paid default. Original provider errors are shown in the system call log with credentials redacted. Local decision roles and ordinary interactive sessions do not acquire an implicit cloud fallback.
+
+Set `WAND_DISABLE_OPENCODE_FALLBACK=1` on the server to disable automatic preparation and the free-group execution service. Free upstream models can be rate-limited, retired, or have different data-retention/training policies; system text sent to this fallback is processed by that provider. See [OpenCode model policies](https://opencode.ai/docs/zen).
+
+Employee onboarding is available in the Web console: **Settings menu → 员工与通讯录 → 管理员工与团队模板 → 员工 → 招聘员工**. Use manual configuration or review HR's draft before confirming onboarding. See the [employee onboarding guide](docs/employee-onboarding.md); `employee:list` only lists definitions, it does not create employees.
 
 ## 中文
 
@@ -226,7 +230,13 @@ npm uninstall -g opencode
 npm install -g opencode-ai@latest
 ```
 
-```
+新系统员工默认使用 OpenCode 的「免费分组」（`wand-model-group/opencode/opencode-free`），这是 Wand 保存并维护的真实分组，不是隐式追加的兜底。服务端每 6 小时刷新原生目录并实际验证全部原生零价格 `opencode/*` 候选（包括不带 `-free` 后缀的模型），加入新可用模型、移除下架/收费/验证失败模型，保留已有优先顺序；客户端只能排序，不能塞入未经验证的成员。首次迁移会把该组放在首位、原候选保留为后备；之后手动调整不被重启覆盖。若原有4格已满则不丢弃任何候选，服务日志提示先腾出一格。缺少 CLI 时自动安装到配置目录下的 `tools/opencode/`，不用 sudo、不覆盖全局 npm 包；系统文本调用使用 `tools/opencode-system/` 的匿名独立环境，不加载用户凭据、项目配置或授权工具，执行前仍检查原生价格。空组或不可用时明确失败，不改用付费默认模型。系统调用日志提供凭据脱敏后的上游原始错误；普通交互会话、显式本地决策不会隐式增加云端候选。
+
+服务环境设置 `WAND_DISABLE_OPENCODE_FALLBACK=1` 可关闭自动准备和免费分组执行服务。免费上游可能限流、退役，数据保留/训练政策也各不相同；使用兜底时系统文本会发往对应提供商，详见 [OpenCode 模型政策](https://opencode.ai/docs/zen)。
+
+### 创建硅基员工
+
+正式入口：**左侧设置菜单 → 员工与通讯录 → 管理员工与团队模板 → 员工 → 招聘员工**。可手动填写资料，或请 HR 嘟嘟拟定后核对并确认入职；起草不会自动创建员工。详见[招聘与入职指南](docs/employee-onboarding.md)。CLI `employee:list` 仅查询定义，创建请使用控制台，无需绕过界面调用内部接口。
 
 ### 功能
 

package/dist/ai-text-runner.d.ts

@@ -1,8 +1,9 @@
 import { type EmployeeTextDeps } from "./employee-text.js";
-import { type AiCallTraceFactory, type SystemAiPurpose } from "./system-ai-call.js";
+import { type AiCallTrace, type AiCallTraceFactory, type SystemAiPurpose } from "./system-ai-call.js";
+import type { OpenCodeTextRuntime, OpenCodeFreePool } from "./opencode-system-fallback.js";
 import type { AiTextRequest, SessionProvider, SessionSnapshot } from "./types.js";
 export { QuickCommitError } from "./command-error.js";
-/** Neutral one-shot text execution. Tool-running Git fallback never uses the retry chain. */
+/** Neutral one-shot text execution. Tool-running Git fallback uses the same employee chain. */
 export declare function defaultProvider(provider: SessionProvider | undefined): SessionProvider;
 export interface QuickCommitAiOptions {
     modelGroups?: import("./model-groups.js").ModelGroup[];
@@ -18,6 +19,10 @@ export interface QuickCommitAiOptions {
     employeeText?: EmployeeTextDeps;
     /** 系统应用必须经员工渠道；没有可用候选时直接失败，不退回默认 provider。 */
     employeeChannelOnly?: boolean;
+    /** Server-owned proof/runtime for the saved OpenCode free group. */
+    opencodeFree?: OpenCodeFreePool;
+    /** Internal anonymous runtime for the final OpenCode-only stage. Never a client DTO. */
+    opencodeRuntime?: OpenCodeTextRuntime;
     /** 整条候选链的时间上限；默认 CLI_CHAIN_BUDGET_MS。第一条消息里的调用要短得多。 */
     budgetMs?: number;
     signal?: AbortSignal;
@@ -48,6 +53,13 @@ export declare function runCliText(command: string, args: string[], prompt: stri
 export declare function callCliAiText(request: AiTextRequest, cwd: string, language: string, opts: CliAiTextOptions): Promise<string>;
 /** 角色设定走系统提示前缀；任务自己的输出格式与约束必须排在后面。 */
 export declare function withOpsPersona(request: AiTextRequest, persona?: string): AiTextRequest;
+export interface ExpandedAiCandidates {
+    chain: import("./types.js").AiCliCandidate[];
+    freeLeaves: Set<import("./types.js").AiCliCandidate>;
+    deadline: number;
+}
+/** Expand the system employee's chain once: groups, free leaves, and duplicates. */
+export declare function expandEmployeeCandidates(opts: QuickCommitAiOptions, trace?: AiCallTrace): Promise<ExpandedAiCandidates>;
 /**
  * Run a lightweight AI request through the system employee's configured chain.
  * provider 与引擎由候选决定；SDK 与 CLI 均保留各自适配和身份。

package/dist/ai-text-runner.js

@@ -11,11 +11,12 @@ import { buildLanguageDirective } from "./language-prompt.js";
 import { candidateInstalled, isSessionProvider } from "./session-provider.js";
 import { asRecord } from "./structured-content.js";
 import { AiCallTraceError } from "./system-ai-call.js";
+import { OPENCODE_FREE_GROUP_SELECTOR } from "./opencode-free-selection.js";
 import { composeSystemFallback, systemPromptFlag, thinkingEffortToClaudeCliEffort, thinkingEffortToCodexReasoningEffort, thinkingEffortToGrokEffort, thinkingEffortToOpenCodeVariant, thinkingEffortToPiLevel, thinkingEffortToQoderEffort } from "./structured-provider-common.js";
 export { QuickCommitError } from "./command-error.js";
 const CLAUDE_MESSAGE_TIMEOUT_MS = 60_000;
 const CODEX_MESSAGE_TIMEOUT_MS = 60_000;
-/** Neutral one-shot text execution. Tool-running Git fallback never uses the retry chain. */
+/** Neutral one-shot text execution. Tool-running Git fallback uses the same employee chain. */
 export function defaultProvider(provider) {
     return isSessionProvider(provider) ? provider : "claude";
 }
@@ -154,11 +155,16 @@ function extractOpenCodeText(stdout) {
             continue;
         try {
             const parsed = JSON.parse(trimmed);
+            if (parsed.type === "tool_use") {
+                throw new QuickCommitError("OpenCode 纯文本调用尝试使用工具，结果未采用。", "CLAUDE_CLI_FAILED");
+            }
             if (parsed.type === "text" && typeof parsed.part?.text === "string" && parsed.part.text.trim()) {
                 texts.push(parsed.part.text.trim());
             }
         }
-        catch {
+        catch (error) {
+            if (error instanceof QuickCommitError)
+                throw error;
             // ignore diagnostics mixed into stdout
         }
     }
@@ -421,18 +427,26 @@ async function callOpenCodeText(request, cwd, opts) {
     if (variant)
         args.push("--variant", variant);
     const stdout = await runCliText("opencode", args, contentWithSystemPrompt("opencode", request), {
-        cwd,
+        cwd: opts.opencodeRuntime?.cwd ?? cwd,
         timeoutMs: cliTextTimeoutMs(CODEX_MESSAGE_TIMEOUT_MS, opts),
         inheritEnv: opts.inheritEnv, signal: opts.signal,
-        // A dedicated per-invocation agent and scalar deny replace rather than merge
-        // wildcard/specific allow rules. Preserve inherited provider/model config.
-        env: base => {
+        // Keep the native tool schemas: Zen rejects tool-less free-tier requests.
+        // Scalar ask replaces inherited allow rules; non-interactive `run` WITHOUT
+        // --auto/--yolo rejects every permission request, so no tool is authorized.
+        // Tool attempts also invalidate the text result. Do not loosen this to allow.
+        // Disable the CLI's unrelated title call (which can use a paid default model).
+        env: inherited => {
+            const base = opts.opencodeRuntime ? opts.opencodeRuntime.env(inherited) : inherited;
             const configured = base.OPENCODE_CONFIG_CONTENT ? JSON.parse(base.OPENCODE_CONFIG_CONTENT) : {};
             if (!configured || typeof configured !== "object" || Array.isArray(configured))
                 throw new Error("OpenCode 内联配置无效。");
-            return { ...base, OPENCODE_PERMISSION: JSON.stringify("deny"), OPENCODE_CONFIG_CONTENT: JSON.stringify({
-                    ...configured, permission: "deny", autoupdate: false, share: "disabled",
-                    agent: { ...configured.agent, [agent]: { mode: "primary", permission: "deny", prompt: "Return only the requested text. Do not use tools." } },
+            return { ...base, OPENCODE_PERMISSION: JSON.stringify("ask"), OPENCODE_CONFIG_CONTENT: JSON.stringify({
+                    ...configured, permission: "ask", autoupdate: false, share: "disabled",
+                    agent: {
+                        ...configured.agent,
+                        title: { ...configured.agent?.title, disable: true },
+                        [agent]: { mode: "primary", permission: "ask", prompt: "Return only the requested text. Do not use tools." },
+                    },
                 }) };
         },
     });
@@ -517,20 +531,42 @@ function singleCandidate(opts) {
         thinkingEffort: opts.thinkingEffort ?? undefined,
     };
 }
-/**
- * 按顺序尝试候选：跳过没安装的 CLI，协议与输出校验均成功才返回。
- * 只有一条候选时保持原行为（错误原样抛出，不摘要）。
- * 仅用于一次性文本生成；执行工具的任务不能使用这条无条件重试路径。
- */
-async function callTextCandidates(request, cwd, language, opts, parseOutput, trace) {
+/** Expand the system employee's chain once: groups, free leaves, and duplicates. */
+export async function expandEmployeeCandidates(opts, trace) {
     opts.signal?.throwIfAborted();
     const { resolveModelGroupModels } = await import("./model-groups.js");
     const modelGroups = opts.modelGroups ?? opts.employeeText?.config.modelGroups;
     const seen = new Set();
-    const chain = (opts.cliCandidates?.length ? opts.cliCandidates : [singleCandidate(opts)])
-        .flatMap((candidate) => resolveModelGroupModels(modelGroups, candidate.provider, candidate.model, { preferDefault: !candidate.model || candidate.model === "default" })
-        .map((model) => ({ ...candidate, model: model || undefined })))
-        .filter(candidate => {
+    const deadline = Date.now() + Math.max(1, opts.budgetMs ?? CLI_CHAIN_BUDGET_MS);
+    const sources = opts.cliCandidates?.length ? opts.cliCandidates : [singleCandidate(opts)];
+    const freeLeaves = new Set();
+    const expanded = [];
+    for (const candidate of sources) {
+        if (candidate.provider === "opencode" && candidate.model === OPENCODE_FREE_GROUP_SELECTOR) {
+            if (!opts.opencodeFree) {
+                trace?.candidateSkipped(candidate, "OpenCode 免费分组执行服务尚未就绪。");
+                continue;
+            }
+            const signal = AbortSignal.any([...(opts.signal ? [opts.signal] : []), AbortSignal.timeout(Math.max(1, deadline - Date.now()))]);
+            try {
+                const members = await abortableEmployeeText(opts.opencodeFree.candidates(signal), signal);
+                for (const member of members) {
+                    const leaf = { ...candidate, ...member, thinkingEffort: "off" };
+                    expanded.push(leaf);
+                    freeLeaves.add(leaf);
+                }
+                if (!members.length)
+                    trace?.candidateSkipped(candidate, "当前没有实测可用且仍免费的 OpenCode 模型。");
+            }
+            catch (error) {
+                trace?.candidateFailed(candidate, error, "availability");
+                opts.signal?.throwIfAborted();
+            }
+            continue;
+        }
+        expanded.push(...resolveModelGroupModels(modelGroups, candidate.provider, candidate.model, { preferDefault: !candidate.model || candidate.model === "default" }).map(model => ({ ...candidate, model: model || undefined })));
+    }
+    const chain = expanded.filter(candidate => {
         const key = JSON.stringify([candidate.provider, candidate.engine ?? "cli", candidate.model ?? "", candidate.thinkingEffort ?? opts.thinkingEffort]);
         if (seen.has(key))
             return false;
@@ -540,10 +576,24 @@ async function callTextCandidates(request, cwd, language, opts, parseOutput, tra
     if (opts.employeeChannelOnly && !opts.cliCandidates?.length) {
         throw new QuickCommitError("系统员工没有可用的执行候选。", "AI_FALLBACK_FAILED");
     }
-    const deadline = Date.now() + Math.max(1, opts.budgetMs ?? CLI_CHAIN_BUDGET_MS);
+    if (!chain.length)
+        throw new QuickCommitError("系统员工没有可用的执行候选；免费分组为空或尚未同步。", "AI_FALLBACK_FAILED");
+    return { chain, freeLeaves, deadline };
+}
+/**
+ * 按顺序尝试候选：跳过没安装的 CLI，协议与输出校验均成功才返回。
+ * 只有一条候选时保持原行为（错误原样抛出，不摘要）。
+ * 文本生成可以无条件换下一条；有副作用的执行要先确认没有产生结果再换。
+ */
+async function callTextCandidates(request, cwd, language, opts, parseOutput, trace) {
+    const modelGroups = opts.modelGroups ?? opts.employeeText?.config.modelGroups;
+    const { chain, freeLeaves, deadline } = await expandEmployeeCandidates(opts, trace);
     const call = async (candidate) => {
+        const free = freeLeaves.has(candidate);
+        const candidateDeadline = free ? Math.min(deadline, Date.now() + 20_000) : deadline;
         if (candidate.engine !== "sdk")
-            return callCliAiText(request, cwd, language, { ...candidateOptions(opts, candidate), deadline });
+            return callCliAiText(request, cwd, language, { ...candidateOptions(opts, candidate),
+                ...(free ? { opencodeRuntime: opts.opencodeFree.execution } : {}), deadline: candidateDeadline });
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(new QuickCommitError("Wand Agent 调用超时。", "CLAUDE_TIMEOUT")), Math.max(1, deadline - Date.now()));
         const signal = opts.signal ? AbortSignal.any([opts.signal, controller.signal]) : controller.signal;

package/dist/auth.d.ts

@@ -27,6 +27,8 @@ export declare class AuthService {
     private readonly sessions;
     private readonly cleanupTimer;
     private disposed;
+    private readonly revokeAllListeners;
+    onRevokeAll(listener: () => void): void;
     constructor(storage: WandStorage, sessionTtlMs?: number, cleanupIntervalMs?: number);
     createSession(principal?: AuthPrincipal): string;
     authenticateSession(token: string | undefined): AuthPrincipal | null;

package/dist/auth.js

@@ -45,6 +45,8 @@ export class AuthService {
     sessions = new Map();
     cleanupTimer;
     disposed = false;
+    revokeAllListeners = new Set();
+    onRevokeAll(listener) { this.revokeAllListeners.add(listener); }
     constructor(storage, sessionTtlMs = SESSION_TTL_MS, cleanupIntervalMs = 1000 * 60 * 10) {
         this.storage = storage;
         this.sessionTtlMs = sessionTtlMs;
@@ -58,6 +60,7 @@ export class AuthService {
         const expiresAt = Date.now() + this.sessionTtlMs;
         const cached = { expiresAt, principal: clonePrincipal(principal) };
         this.sessions.set(token, cached);
+        // 所有登录态（含票据登录）持久化，和密码登录一样跨服务重启有效。
         this.storage.saveAuthSession(token, expiresAt, cached.principal);
         return token;
     }
@@ -79,6 +82,12 @@ export class AuthService {
             }
             return null;
         }
+        // Retire cookies minted by the early ticket prototype. Native App sessions
+        // use the established multi-scope principal; a sessions-only connected-app
+        // cookie must never regain broad workbench access after upgrade.
+        if (cached.principal.kind === "connected-app" && cached.principal.scopes.length === 1
+            && cached.principal.scopes[0] === "sessions")
+            return null;
         return clonePrincipal(cached.principal);
     }
     validateSession(token) {
@@ -95,6 +104,8 @@ export class AuthService {
             return;
         this.sessions.clear();
         this.storage.deleteAllAuthSessions();
+        for (const listener of this.revokeAllListeners)
+            listener();
     }
     dispose() {
         if (this.disposed)
@@ -102,6 +113,9 @@ export class AuthService {
         this.disposed = true;
         clearInterval(this.cleanupTimer);
         this.sessions.clear();
+        for (const listener of this.revokeAllListeners)
+            listener();
+        this.revokeAllListeners.clear();
     }
     cleanupExpiredSessions() {
         if (this.disposed)

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "4847c707610a53b4a503aa7348771ac4299e0936",
-  "builtAt": "2026-10-16T00:07:56.100Z",
-  "version": "4.96.1-beta.365.1.g4847c70",
-  "channel": "beta"
+  "commit": "a09542822526896c8dcc2c5af5862441fdb58282",
+  "builtAt": "2026-10-17T13:42:08.826Z",
+  "version": "4.97.0",
+  "channel": "stable"
 }

package/dist/cli-api.d.ts

@@ -4,7 +4,7 @@ export declare class WandCliApi {
     private cookie;
     constructor(config: WandConfig);
     get<T>(pathname: string): Promise<T>;
-    post<T>(pathname: string, body: unknown): Promise<T>;
+    post<T>(pathname: string, body: unknown, headers?: Record<string, string>): Promise<T>;
     patch<T>(pathname: string, body: unknown): Promise<T>;
     del<T>(pathname: string): Promise<T>;
     private login;

package/dist/cli-api.js

@@ -9,8 +9,8 @@ export class WandCliApi {
     async get(pathname) {
         return this.request("GET", pathname);
     }
-    async post(pathname, body) {
-        return this.request("POST", pathname, body);
+    async post(pathname, body, headers) {
+        return this.request("POST", pathname, body, headers);
     }
     async patch(pathname, body) {
         return this.request("PATCH", pathname, body);
@@ -21,15 +21,15 @@ export class WandCliApi {
     async login() {
         const result = await this.rawRequest("POST", "/api/login", { password: this.config.password });
         if (result.status < 200 || result.status >= 300)
-            throw new Error(`Wand 登录失败 (HTTP ${result.status})`);
+            throw Object.assign(new Error(`Wand 登录失败 (HTTP ${result.status})`), { status: result.status });
         this.cookie = result.cookies.map((value) => value.split(";", 1)[0]).join("; ");
         if (!this.cookie)
             throw new Error("Wand 服务未返回登录会话。");
     }
-    async request(method, pathname, body) {
+    async request(method, pathname, body, headers) {
         if (!this.cookie)
             await this.login();
-        const result = await this.rawRequest(method, pathname, body, this.cookie);
+        const result = await this.rawRequest(method, pathname, body, this.cookie, headers);
         let parsed = {};
         try {
             parsed = result.body ? JSON.parse(result.body) : {};
@@ -41,11 +41,11 @@ export class WandCliApi {
             ? parsed.error
             : null;
         if (result.status < 200 || result.status >= 300 || error) {
-            throw new Error(`Wand 请求失败 (HTTP ${result.status})${error ? `：${error}` : ""}`);
+            throw Object.assign(new Error(`Wand 请求失败 (HTTP ${result.status})${error ? `：${error}` : ""}`), { status: result.status });
         }
         return parsed;
     }
-    rawRequest(method, pathname, body, cookie) {
+    rawRequest(method, pathname, body, cookie, headers) {
         return new Promise((resolve, reject) => {
             const protocol = this.config.https ? "https:" : "http:";
             const url = new URL(`${protocol}//127.0.0.1:${this.config.port}${pathname}`);
@@ -56,6 +56,7 @@ export class WandCliApi {
                 rejectUnauthorized: false,
                 timeout: 30_000,
                 headers: {
+                    ...headers,
                     Accept: "application/json",
                     ...(payload ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) } : {}),
                     ...(cookie ? { Cookie: cookie } : {}),

package/dist/cli.js

@@ -197,6 +197,8 @@ async function main() {
             }
             break;
         }
+        case "web-login:issue":
+        case "web-login:cancel":
         case "employee:list":
         case "workspace:list":
         case "session:create":
@@ -205,6 +207,9 @@ async function main() {
         case "schedule:read":
         case "schedule:create":
         case "schedule:update": {
+            if (command === "web-login:issue" && (process.stdout.isTTY || process.env.WAND_WEB_LOGIN_PIPE !== "1" || process.env.DEBUG || process.env.PWDEBUG || process.env.NODE_DEBUG)) {
+                throw new Error("票据只能通过 wand-system 的受控内存助手传递；禁止终端回显和调试录制。");
+            }
             const { parseSystemCliCommand } = await import("./system-cli.js");
             const operationArgs = args.slice(1);
             for (const flag of ["-c", "--config"]) {
@@ -354,6 +359,8 @@ Agent runtime:
   wand system:skills [--providers pi,claude,...]  Install the managed wand-system skill
   wand employee:list [--include-archived]  List employee definitions (not private knowledge)
   wand workspace:list       List project directories
+  wand web-login:issue --stdin  Mint a 60s, one-use Web admin ticket (employee execution proof + controlled pipe only)
+  wand web-login:cancel --stdin  Cancel an unconsumed ticket by requestId
   wand session:create --stdin  Create an employee session from JSON
   wand session:resume <id> --stdin  Continue the exact structured session with JSON input
   wand schedule:list [--include-cancelled]
@@ -1019,6 +1026,13 @@ function printServiceResult(result, verbose) {
     }
 }
 main().catch((error) => {
-    process.stderr.write(`[wand] ${getErrorMessage(error)}\n`);
+    if (["web-login:issue", "web-login:cancel"].includes(process.argv[2] ?? "") && process.env.WAND_WEB_LOGIN_PIPE === "1" && !process.stdout.isTTY) {
+        const status = typeof error?.status === "number" ? error.status : 0;
+        const rejected = status >= 400 && status < 500 && ![408, 409].includes(status);
+        // Only machine facts enter the pipe; never reflect a remote error, credential or stack.
+        process.stdout.write(JSON.stringify({ error: { code: rejected ? "ISSUANCE_REJECTED" : "DELIVERY_UNKNOWN", status } }) + "\n");
+    }
+    else
+        process.stderr.write(`[wand] ${getErrorMessage(error)}\n`);
     process.exitCode = 1;
 });

package/dist/config.js

@@ -201,8 +201,8 @@ export async function loadConfigWithStorage(configPath, storage) {
  */
 export function bootstrapBuiltinEmployees(config, storage) {
     // 内置「系统运维」员工负责 commit message / 标题 / 提示词优化；招聘由 HR 负责。
-    // 这里只做幂等补齐——首次按用户已有的系统 AI 工具与默认
-    // provider 建首条候选，之后候选由用户在员工设置里维护，不再回写 config。
+    // 新系统员工默认用服务端维护的 OpenCode 免费分组；显式旧系统 AI 选择仍优先。
+    // 这里只幂等补齐；已有员工候选由用户维护，不在重启时改写。
     storage.ensureSystemSiliconEmployee({
         cli: config.systemAiCli,
         model: config.systemAiModel,

package/dist/decision-skill.d.ts

@@ -1,5 +1,3 @@
+import { type ManagedSkillInstallResult } from "./managed-skill.js";
 import { type SessionProvider } from "./provider-catalog.js";
-export declare function installDecisionSkill(configDir: string, providers?: readonly SessionProvider[], home?: string): Promise<{
-    installed: string[];
-    providers: readonly SessionProvider[];
-}>;
+export declare function installDecisionSkill(configDir: string, providers?: readonly SessionProvider[], home?: string): Promise<ManagedSkillInstallResult>;

package/dist/employee-knowledge.d.ts

@@ -3,4 +3,7 @@ import type { StructuredRunnerAdapter, StructuredRunnerContext, StructuredRunner
 /** Strong-prefix requests are an explicit, local data operation, not an extra model invocation. */
 export declare function rememberExplicitEmployeeRequest(storage: WandStorage, employeeId: string | undefined, prompt: string): string | null;
 /** Central runner boundary shared by all CLI providers; credentials live only in the child env. */
-export declare function startEmployeeKnowledgeRunner(storage: WandStorage, runner: StructuredRunnerAdapter, context: StructuredRunnerContext, observer: StructuredRunnerObserver): StructuredRunnerExecution;
+export declare function startEmployeeKnowledgeRunner(storage: WandStorage, runner: StructuredRunnerAdapter, context: StructuredRunnerContext, observer: StructuredRunnerObserver, webLoginGrant?: (sessionId: string, employeeId: string) => {
+    proof: string;
+    revoke(): void;
+}): StructuredRunnerExecution;

package/dist/employee-knowledge.js

@@ -48,13 +48,14 @@ export function rememberExplicitEmployeeRequest(storage, employeeId, prompt) {
     }
 }
 /** Central runner boundary shared by all CLI providers; credentials live only in the child env. */
-export function startEmployeeKnowledgeRunner(storage, runner, context, observer) {
+export function startEmployeeKnowledgeRunner(storage, runner, context, observer, webLoginGrant) {
     const employeeId = context.session.employeeId;
     // Strip any inherited credentials from the parent environment (including nested Wand runs).
     // Non-secret identity, overwritten for nested executions; never infer a current session by title/time.
     const env = { ...context.env, WAND_SESSION_ID: context.session.id };
     delete env.WAND_KNOWLEDGE_DB;
     delete env.WAND_KNOWLEDGE_TOKEN;
+    delete env.WAND_WEB_LOGIN_PROOF;
     if (!employeeId)
         return runner.start({ ...context, env }, observer);
     if (!storage.getSiliconEmployee(employeeId)) {
@@ -63,20 +64,30 @@ export function startEmployeeKnowledgeRunner(storage, runner, context, observer)
             } }, observer);
     }
     const token = storage.issueEmployeeKnowledgeAccess(context.session.id, employeeId);
-    const cleanup = () => { try {
-        storage.revokeEmployeeKnowledgeAccess(token);
-    }
-    catch { /* storage may be closing */ } };
+    let loginGrant;
+    const cleanup = () => {
+        loginGrant?.revoke();
+        try {
+            storage.revokeEmployeeKnowledgeAccess(token);
+        }
+        catch { /* storage may be closing */ }
+    };
     try {
+        // Optional Web login must not prevent an otherwise valid employee execution.
+        try {
+            loginGrant = webLoginGrant?.(context.session.id, employeeId);
+        }
+        catch { /* CLI reports unavailable when explicitly used. */ }
         const receipt = (!context.session.automationId || context.session.automationId.startsWith("wand-task:"))
             ? rememberExplicitEmployeeRequest(storage, employeeId, context.prompt) : null;
         const runtimeSystemPrompt = [context.session.runtimeSystemPrompt, `当前 Wand 会话 ID：${context.session.id}（非凭据；创建后续检查计划时用作精确续接目标）。`, receipt, knowledgeContext(storage, employeeId, context.prompt)]
             .filter(Boolean).join("\n\n");
         const execution = runner.start({ ...context,
             session: { ...context.session, runtimeSystemPrompt },
-            env: { ...env, WAND_KNOWLEDGE_DB: storage.databasePath(), WAND_KNOWLEDGE_TOKEN: token },
+            env: { ...env, WAND_KNOWLEDGE_DB: storage.databasePath(), WAND_KNOWLEDGE_TOKEN: token,
+                ...(loginGrant ? { WAND_WEB_LOGIN_PROOF: loginGrant.proof } : {}) },
         }, observer);
-        return { ...execution, completion: execution.completion.finally(cleanup), interrupt: () => execution.interrupt() };
+        return { ...execution, completion: execution.completion.finally(cleanup), interrupt: () => { loginGrant?.revoke(); execution.interrupt(); } };
     }
     catch (error) {
         cleanup();

package/dist/employee-text.d.ts

@@ -23,7 +23,7 @@ export declare function employeeTextCandidates(agents: readonly WandTaskAgent[],
 export declare function abortableEmployeeText<T>(pending: Promise<T>, signal: AbortSignal): Promise<T>;
 export declare class EmployeeCandidateRejected extends Error {
     readonly failure: StructuredFailure;
-    constructor(failure: StructuredFailure);
+    constructor(failure: StructuredFailure, message?: string);
 }
 /** Prepare a configured, no-tool adapter before any user input is accepted. */
 export declare function prepareEmployeeTextCandidate(deps: EmployeeTextDeps, agent: WandTaskAgent, request: AiTextRequest, signal: AbortSignal): Promise<() => Promise<string>>;

package/dist/employee-text.js

@@ -47,8 +47,8 @@ export async function abortableEmployeeText(pending, signal) {
 }
 export class EmployeeCandidateRejected extends Error {
     failure;
-    constructor(failure) {
-        super("SDK 候选在执行前被拒绝。");
+    constructor(failure, message = "SDK 候选在执行前被拒绝。") {
+        super(message);
         this.failure = failure;
     }
 }
@@ -62,8 +62,8 @@ function sdkText(message, status) {
             signal: null, stderr: "", primaryError: "SDK 文字生成失败。", rejection,
             inputAccepted: rejection && !progressed ? false : undefined }, { progress: progressed });
         if (failure?.retryable)
-            throw new EmployeeCandidateRejected(failure);
-        throw new Error("SDK文字生成失败。");
+            throw new EmployeeCandidateRejected(failure, message.errorMessage || "SDK 候选在执行前被拒绝。");
+        throw new Error(message.errorMessage || "SDK文字生成失败。");
     }
     if (message.stopReason === "aborted" || message.content.some(part => part.type === "toolCall"))
         throw new Error("SDK文字生成失败。");

package/dist/env-utils.js

@@ -73,7 +73,7 @@ export function buildChildEnv(inheritEnv, extras = {}) {
         }
     }
     // Do not let nested Wand/PTY or one-shot automation inherit another run's decision capability.
-    for (const key of ["WAND_DECISION_URL", "WAND_DECISION_TOKEN", "WAND_DECISION_CA", "WAND_DECISION_NODE", "WAND_DECISION_CLI"])
+    for (const key of ["WAND_DECISION_URL", "WAND_DECISION_TOKEN", "WAND_DECISION_CA", "WAND_DECISION_NODE", "WAND_DECISION_CLI", "WAND_WEB_LOGIN_PROOF"])
         delete base[key];
     for (const [k, v] of Object.entries(extras)) {
         if (typeof v === "string")

package/dist/feedback-feature-map.d.ts

@@ -0,0 +1,56 @@
+import type { FeedbackFeature } from "./feedback.js";
+/** Canonical route-family ownership. Native clients mirror these explicit entries, not error text. */
+export declare const FEEDBACK_API_FEATURES: {
+    readonly sessions: "sessions";
+    readonly "structured-sessions": "sessions";
+    readonly commands: "sessions";
+    readonly "session-list": "sessions";
+    readonly "session-directories": "sessions";
+    readonly conversations: "conversations";
+    readonly "wand-tasks": "tasks";
+    readonly "wand-task-agent-defaults": "tasks";
+    readonly tasks: "tasks";
+    readonly "workspace-tasks": "tasks";
+    readonly workspaces: "tasks";
+    readonly "wand-milestones": "tasks";
+    readonly missions: "tasks";
+    readonly "scheduled-tasks": "tasks";
+    readonly files: "files";
+    readonly upload: "files";
+    readonly directory: "files";
+    readonly "session-files": "files";
+    readonly "file-preview": "files";
+    readonly "file-read": "files";
+    readonly "file-write": "files";
+    readonly "recent-paths": "files";
+    readonly speech: "speech";
+    readonly settings: "settings";
+    readonly config: "settings";
+    readonly "user-profile": "settings";
+    readonly "auto-update": "settings";
+    readonly "update-channel": "settings";
+    readonly models: "models";
+    readonly "model-groups": "models";
+    readonly "local-models": "models";
+    readonly login: "authentication";
+    readonly logout: "authentication";
+    readonly "app-login": "authentication";
+    readonly "session-check": "authentication";
+    readonly "set-password": "authentication";
+    readonly update: "server_update";
+    readonly "update-status": "server_update";
+    readonly "check-update": "server_update";
+    readonly "android-apk-update": "app_update";
+    readonly "android-apk": "app_update";
+    readonly "macos-app-update": "app_update";
+    readonly "macos-dmg-update": "app_update";
+    readonly "macos-dmg": "app_update";
+    readonly "ios-ipa-update": "app_update";
+    readonly "ios-ipa": "app_update";
+    readonly "provider-cli-updates": "provider_update";
+    readonly "daemon-maintenance": "daemon_update";
+    readonly "storage-cleanup": "storage";
+    readonly git: "repository";
+    readonly github: "repository";
+};
+export declare function feedbackFeatureForApiPath(pathname: string): FeedbackFeature;

package/dist/feedback-feature-map.js

@@ -0,0 +1,20 @@
+/** Canonical route-family ownership. Native clients mirror these explicit entries, not error text. */
+export const FEEDBACK_API_FEATURES = {
+    sessions: "sessions", "structured-sessions": "sessions", commands: "sessions", "session-list": "sessions", "session-directories": "sessions",
+    conversations: "conversations",
+    "wand-tasks": "tasks", "wand-task-agent-defaults": "tasks", tasks: "tasks", "workspace-tasks": "tasks", workspaces: "tasks", "wand-milestones": "tasks", missions: "tasks", "scheduled-tasks": "tasks",
+    files: "files", upload: "files", directory: "files", "session-files": "files", "file-preview": "files", "file-read": "files", "file-write": "files", "recent-paths": "files",
+    speech: "speech",
+    settings: "settings", config: "settings", "user-profile": "settings", "auto-update": "settings", "update-channel": "settings",
+    models: "models", "model-groups": "models", "local-models": "models",
+    login: "authentication", logout: "authentication", "app-login": "authentication", "session-check": "authentication", "set-password": "authentication",
+    update: "server_update", "update-status": "server_update", "check-update": "server_update",
+    "android-apk-update": "app_update", "android-apk": "app_update", "macos-app-update": "app_update", "macos-dmg-update": "app_update", "macos-dmg": "app_update", "ios-ipa-update": "app_update", "ios-ipa": "app_update",
+    "provider-cli-updates": "provider_update", "daemon-maintenance": "daemon_update", "storage-cleanup": "storage",
+    git: "repository", github: "repository",
+};
+export function feedbackFeatureForApiPath(pathname) {
+    const family = pathname.split("?")[0].split("/")[2] ?? "";
+    return Object.prototype.hasOwnProperty.call(FEEDBACK_API_FEATURES, family)
+        ? FEEDBACK_API_FEATURES[family] : "api";
+}